1
0
mirror of https://github.com/php/php-src.git synced 2026-04-12 10:33:11 +02:00
Commit Graph

5854 Commits

Author SHA1 Message Date
Pierrick Charron
212ebeed68 Making PHP 8.2.0 beta3 2022-08-16 11:23:58 -04:00
twosee
ef39adb638 Merge branch 'PHP-8.1'
* PHP-8.1:
  Re-fix GH-8409: SSL handshake timeout persistent connections hanging
  Revert "Fix GH-8409: SSL handshake timeout persistent connections hanging"
2022-08-14 20:15:35 +08:00
twosee
14d71957ca Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Re-fix GH-8409: SSL handshake timeout persistent connections hanging
2022-08-14 20:14:57 +08:00
twosee
b8d07451d4 Re-fix GH-8409: SSL handshake timeout persistent connections hanging
This fix is another solution to replace d0527427be, use zend_try and zend_catch to make sure persistent stream will be released when error occurred.

Closes GH-9332.
2022-08-14 20:13:36 +08:00
Jakub Zelenka
897ca85d33 Revert "Fix GH-8409: SSL handshake timeout persistent connections hanging"
This reverts commit d0527427be.

This patch makes Swoole/Swow can not work anymore, because Coroutine will yield to another one during socket operation, EG(record_errors) assertion will always fail, and zend_begin_record_errors() was only used during compile time before.
Note: zend_emit_recorded_errors() and the typo fix are reserved.
2022-08-14 19:41:06 +08:00
Jakub Zelenka
438f692e92 Merge branch 'PHP-8.1' 2022-08-12 17:12:28 +01:00
Jakub Zelenka
d0527427be Fix GH-8409: SSL handshake timeout persistent connections hanging
This is not actually related to SSL handshake but stream socket creation
which does not clean errors if the error handler is set. This fix
prevents emitting errors until the stream is freed.
2022-08-12 17:09:24 +01:00
David CARLIER
393577ced9 reallocarray using proper inline facility to check overflow on windows. (#9300) 2022-08-12 12:08:03 +01:00
Jakub Zelenka
80197c59ec Merge branch 'PHP-8.1' 2022-08-07 14:22:33 +01:00
Jakub Zelenka
c9fa98a174 Merge branch 'PHP-8.0' into PHP-8.1 2022-08-07 14:21:39 +01:00
Jakub Zelenka
d9ff5e079f Fix GH-8472: stream_socket_accept result may have incorrect metadata 2022-08-07 14:17:38 +01:00
Jakub Zelenka
1a9e6895f1 Fix #65069: GlobIterator incorrect handling of open_basedir check
This PR changes the glob stream wrapper so it impacts "glob://"
streamsas well. The idea is to do a check for each found path instead
of the pattern which was not working correctly.
2022-07-28 11:42:42 +01:00
Patrick Allaert
9af3327176 PHP-8.1 is now for PHP 8.1.10-dev 2022-07-20 06:48:52 +02:00
Javier Eguiluz
37cf7f6d3c [ci skip] Fix minor typos
Closes GH-9047.
2022-07-19 16:43:44 +02:00
Go Kudo
4d8dd8d258 Implement Random Extension
https://wiki.php.net/rfc/rng_extension
https://wiki.php.net/rfc/random_extension_improvement
2022-07-19 10:27:38 +01:00
Eric Norris
09237f6126 Update request startup error messages 2022-07-18 23:19:59 +01:00
Jakub Zelenka
922371f3b1 Do not send X-Powered-By if headers sent (#9039)
Co-authored-by: Eric Norris <erictnorris@gmail.com>
2022-07-18 18:01:05 +01:00
Mikhail Galanin
ffdf25a270 Add "error_log_mode" setting 2022-07-18 15:41:28 +01:00
Jakub Zelenka
0a4a55fd44 Allow to not close stream on rscr dtor in php cli sapi 2022-07-18 10:58:50 +01:00
Rowan Tommins
af15923bc3 Extend deprecation notices to is_callable($foo) and callable $foo
Implements https://wiki.php.net/rfc/partially-supported-callables-expand-deprecation-notices
so that uses of "self" and "parent" in is_callable() and callable
type constraints now raise a deprecation notice, independent of the
one raised when and if the callable is actually invoked.

A new flag is added to the existing check_flags parameter of
zend_is_callable / zend_is_callable_ex, for use in internal calls
that would otherwise repeat the notice multiple times. In particular,
arguments to internal function calls are checked first based on
arginfo, and then again during ZPP, so the former suppresses the
deprecation notice.

Some existing tests which raised this deprecation have been updated
to avoid the syntax, but the existing version retained for maximum
regression coverage until it is made an error.

With thanks to Juliette Reinders Folmer for the RFC and initial
investigation.

Closes GH-8823.
2022-07-14 17:07:42 +02:00
Christoph M. Becker
31b02a13ab Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix GH-8923: error_log on Windows can hold the file write lock
2022-07-12 13:39:55 +02:00
Christoph M. Becker
5a459f6783 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix GH-8923: error_log on Windows can hold the file write lock
2022-07-12 13:38:35 +02:00
Christoph M. Becker
77e954afaa Fix GH-8923: error_log on Windows can hold the file write lock
On Windows, closing a file which is locked may not immediately remove
the lock.  The `LockFileEx()` documentation states:

| Therefore, it is recommended that your process explicitly unlock all
| files it has locked when it terminates.

We comply, and also use the macro `LOCK_EX` instead of the magic number
`2`.

Closes GH-8925.
2022-07-12 13:36:20 +02:00
George Peter Banyard
55908db007 Add php_register_known_variable() for know var names 2022-07-01 21:18:26 +01:00
David Carlier
7ceae66182 streams/xp_socket: fix clang build error with enum usage on bool condition.
Fix targeted for oses defining those flags as enums (like Linux/glibc).

`error: converting the enum constant to a boolean [-Werror,-Wint-in-bool-context]
                                } else if ((!sslsock->ssl_active && value == 0 && (MSG_DONTWAIT || !sslsock->s.is_blocked)) ||`

Closes #8895.
2022-06-30 05:45:33 +01:00
Max Kellermann
e2bd3b1e99 main/streams/plain_wrapper: skip lseek(SEEK_CUR) for newly opened files
A file that has just been opened is known to be at offset zero, and
the lseek(SEEK_CUR) system call to determine the current offset can be
skipped.

Closes #8540.
2022-06-29 18:11:01 +01:00
David CARLIER
bf29ee6917 Add reallocarray implementation.
In a similar model as _safe_*alloc api but for the `userland` it guards
against overflow before (re)allocation, usage concealed in fpm for now.
Modern Linux and most of BSD already have it.
Closes #8871.
2022-06-26 13:10:13 +01:00
Ben Ramsey
f3b45e74f5 PHP-8.1 is now for PHP 8.1.9-dev 2022-06-21 11:03:50 -05:00
Heiko Weber
84e4d2a0e8 Refactor sapi_getenv() (#8786) 2022-06-20 17:32:13 +01:00
David Carlier
bfe6f9e66a Introduction of timing attack safe bcmp implementation.
Nothing new but to refactor usage b/w hash and password
extensions but using volatile pointers to be a bit safer,
allowing to expand its usage eventually.
2022-06-20 16:30:30 +01:00
Christoph M. Becker
640c1c3a09 Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix potential use after free in php_binary_init()
2022-06-20 12:03:47 +02:00
Christoph M. Becker
5f24b85fd2 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix potential use after free in php_binary_init()
2022-06-20 12:02:31 +02:00
Heiko Weber
93a44f8c50 Fix potential use after free in php_binary_init()
Closes GH-8791.
2022-06-20 12:00:50 +02:00
Jakub Zelenka
3f836641d5 Merge branch 'PHP-8.1' 2022-06-19 22:57:26 +01:00
Jakub Zelenka
d9cca443ad Fix strict prototype for php_closelog 2022-06-19 22:56:44 +01:00
Jakub Zelenka
305d5e12df Merge branch 'PHP-8.1' 2022-06-19 20:12:43 +01:00
Jakub Zelenka
b3e6faed48 Merge branch 'PHP-8.0' into PHP-8.1 2022-06-19 20:09:37 +01:00
Jakub Zelenka
e330f443c9 Fix bug #67764: fpm: syslog.ident does not work 2022-06-19 20:05:49 +01:00
Max Kellermann
2d986310f1 streams/xp_socket: eliminate poll() when MSG_DONTWAIT is available
If there is a zero timeout and MSG_DONTWAIT is available (or the
socket is non-blocking), the poll() call is not necessary, and we can
just call recv() right away.

Before this change:

 poll([{fd=4, events=POLLIN|POLLPRI|POLLERR|POLLHUP}], 1, 0) = 0 (Timeout)
 poll([{fd=4, events=POLLIN|POLLERR|POLLHUP}], 1, 60000) = 1 ([{fd=4, revents=POLLIN}])
 recvfrom(4, "HTTP/1.1 301 Moved Permanently\r\n"..., 8192, MSG_DONTWAIT, NULL, NULL) = 348
 poll([{fd=4, events=POLLIN|POLLPRI|POLLERR|POLLHUP}], 1, 0) = 1 ([{fd=4, revents=POLLIN}])
 recvfrom(4, "", 1, MSG_PEEK, NULL, NULL) = 0

After this change:

 recvfrom(4, 0x7ffe0cc719a0, 1, MSG_PEEK|MSG_DONTWAIT, NULL, NULL) = -1 EAGAIN (Resource temporarily unavailable)
 poll([{fd=4, events=POLLIN|POLLERR|POLLHUP}], 1, 60000) = 1 ([{fd=4, revents=POLLIN}])
 recvfrom(4, "HTTP/1.1 301 Moved Permanently\r\n"..., 8192, MSG_DONTWAIT, NULL, NULL) = 348
 recvfrom(4, "", 1, MSG_PEEK|MSG_DONTWAIT, NULL, NULL) = 0

The first poll() is replaced by recvfrom(), and the third poll() is
omitted completely.

ext/openssl/xp_ssl: eliminate poll() when MSG_DONTWAIT is available

If there is a zero timeout and MSG_DONTWAIT is available (or the
socket is non-blocking), the poll() call is not necessary, and we can
just call recv() right away.

Closes GH-8092.
2022-06-18 19:44:32 +01:00
Arnaud Le Blanc
efc8f0ebf8 Deprecate zend_atol() / add zend_ini_parse_quantity() (#7951)
Add zend_ini_parse_quantity() and deprecate zend_atol(), zend_atoi()

zend_atol() and zend_atoi() don't just do number parsing.
They also check for a 'K', 'M', or 'G' at the end of the string,
and multiply the parsed value out accordingly.

Unfortunately, they ignore any other non-numerics between the
numeric component and the last character in the string.
This means that numbers such as the following are both valid
and non-intuitive in their final output.

* "123KMG" is interpreted as "123G" -> 132070244352
* "123G " is interpreted as "123 " -> 123
* "123GB" is interpreted as "123B" -> 123
* "123 I like tacos." is also interpreted as "123." -> 123

Currently, in php-src these functions are used only for parsing ini values.

In this change we deprecate zend_atol(), zend_atoi(), and introduce a new
function with the same behavior, but with the ability to report invalid inputs
to the caller. The function's name also makes the behavior less unexpected:
zend_ini_parse_quantity().

Co-authored-by: Sara Golemon <pollita@php.net>
2022-06-17 14:12:53 +02:00
Dmitry Stogov
2df805da7e Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix use after free
2022-06-14 12:50:16 +03:00
Dmitry Stogov
6797f338a7 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix use after free
2022-06-14 12:45:12 +03:00
Dmitry Stogov
0b8e471b3c Fix use after free
This fixes oss-fuzz #47997
2022-06-14 12:44:37 +03:00
Ilija Tovilo
c019421912 Fix regression from GH-8587 (#8615)
* Fix regression from GH-8587

Streams hold a reference to the stream wrapper. User stream wrappers
must not be released until the streams themselves are closed.

* Add test for directories
2022-06-09 13:49:41 +02:00
George Peter Banyard
d08451b2ca Replace php_stdint.h header with standard headers (#8613) 2022-05-29 11:20:56 +01:00
Calvin Buckley
2920a26636 Quote when adding to connection string in (PDO_)ODBC
Because the UID= and PWD= values are appended to the SQLDriverConnect
case when credentials are passed, we have to append them to the string
in case users are relying on this behaviour. However, they must be
quoted, or the arguments will be invalid (or possibly more injected).
This means users had to quote arguments or append credentials to the raw
connection string themselves.

It seems that ODBC quoting rules are consistent enough (and that
Microsoft trusts them enough to encode into the .NET BCL) that we can
actually check if the string is already quoted (in case a user is
already quoting because of this not being fixed), and if not, apply the
appropriate ODBC quoting rules.

This is because the code exists in main/, and are shared between
both ODBC extensions, so it doesn't make sense for it to only exist
in one or the other. There may be a better spot for it.

Closes GH-8307.
2022-05-27 16:56:44 +02:00
George Peter Banyard
8685a7f03c Remove custom alloca() (#8513)
* Use arena in DCE instead of multiple alloca()
  This requires passing the optimizer context

* Use our do_alloca() instead of alloca()

* Use emalloc in DEBUG builds instead of stack allocations for do_alloca()
  This helps detecting that we correctly free do_alloca()
2022-05-27 09:05:33 +01:00
Patrick Allaert
3b6ee1eb19 Bump for 8.1.8-dev 2022-05-25 00:54:00 +02:00
Sara Golemon
e05897fe5e Bump for 8.0.21 2022-05-24 18:51:01 +00:00
Michael Voříšek
fb1c7eff04 Fix some level 1 MSVC compiler warnings on x86
See GH-8479.
2022-05-24 13:05:16 +02:00